Change Management Regulatory Frameworks & Compliance 4

Question 1

A publicly traded company's change advisory board is reviewing a major ERP upgrade. Which SOX-related control must be confirmed before the change can be approved?

Accepted Answer

User access rights will be reviewed and recertified post-deployment

Answer

SOX requires that access rights to financially significant systems be reviewed after major changes to ensure that inappropriate access was not introduced during implementation.

Question 2

Which compliance standard requires organizations to maintain a formal system development life cycle (SDLC) with integrated change control gates?

Accepted Answer

NIST SP 800-128

Answer

NIST SP 800-128 provides guidance for security-focused configuration change control integrated throughout the SDLC for federal information systems.

Question 3

When a change to a regulated system is rolled back due to failure, what compliance action is typically required?

Accepted Answer

The rollback itself must be treated as a change and documented accordingly

Answer

Regulators treat rollbacks as changes that must be documented, authorized, and logged because they alter the system state and could introduce their own risks.

Question 4

Under FISMA, federal agencies must implement change control processes aligned with which NIST publication?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the security and privacy controls, including CM (Configuration Management) controls, that FISMA-regulated federal agencies must implement.

Question 5

A compliance officer discovers that a software team deployed a change without CAB approval by classifying it as a 'standard change.' What is the MOST appropriate compliance response?

Accepted Answer

Conduct a post-implementation review and determine if the change met standard change criteria

Answer

The correct response is to review whether the change legitimately qualified as a standard change and document findings, as misclassification of changes is a compliance risk.

Change Management Practice Test

Change Management Practice Test

Change Management Regulatory Frameworks & Compliance 4